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Secret sharing is a procedure for splitting a message into several parts so that no subset of parts is 
sufficient to read the message, but the entire set is. We show how this procedure can be implemented 
using GHZ states. In the quantum case the presence of an eavesdropper will introduce errors so 
that his presence can be detected. We also show how GHZ states can be used to split quantum 
information into two parts so that both parts are necessary to reconstruct the original qubit. 
PACS numbers: 03.65. Bz, 89.70.+C 



I. INTRODUCTION 

Suppose Alice, who is in New York, wants to have an 
action taken on her behalf in Prague. There she has two 
agents. Bob and Charlie, who can carry it out for her, 
but she knows that one of them, and only one, is dishon- 
est, and she does not know which is the honest one. She 
cannot simply send a message to both, because the dis- 
honest one will try to sabotage the action, but she knows 
that if the two of them carry out it together, the honest 
one will keep the dishonest one from doing any damage. 
What can she do? 

Classical cryptography provides an answer which is 
known as secret sharing It can be used, for exam- 
ple, to guarantee that no single person can open a vault, 
has access to an industrial secret, or can launch a mis- 
sile with a nuclear warhead, but two together can. This 
means that for security to be breached, two people must 
act in concert, thereby making it more difficult for any 
single person who wants to gain illegal access to the se- 
cret information; he must convince the other party to go 
along, and he risks discovery in the process. 

How can Alice implement this procedure? From her 
original message, she creates two coded messages one of 
which is sent to Bob and the other to Charlie. Each of 
the encrypted messages contains no information about 
her original message, but together they contain the com- 
plete message. Therefore, neither Bob nor Charlie alone 
can find out what Alice wants to do, but the two of them 
acting together can. This can be accomplished by taking 
the original message, which we can think of as a binary 
bit string, and adding to it a random bit string of the 
same length. The addition is done modulo 2 and bitwise. 
Alice then takes this string and a copy of the random 
string and sends one to Bob and the other to Charlie. At 
this point neither is in a position to learn Alice's mes- 
sage. However, if they get together and add their two 
strings together, bitwise and modulo 2, Alice's message 
emerges. There are also classical protocols which allow 
Alice to split her message into more than two parts. 

So far we have not mentioned the problem of eaves- 
dropping, but this is something Alice must consider. If 
either a fourth party or the dishonest member of the 



Bob-Charlie pair gains access to both of Alice's trans- 
missions, then they can learn the contents of her mes- 
sage. Eavesdroppers can, however, be defeated by using 
quantum cryptographic protocols. Quantum cryptogra- 
phy provides for the secure transmission of information 
by enabling one to determine whether an eavesdropper 
has attempted to gain information about the key which 
is being used to encode the message [|[j4|. If not, the key 
can be used and the information sent by using it will be 
secure, and if an eavesdropper has been detected, then 
one has to establish a new key. 

We would like to show that it is possible to com- 
bine quantum cryptography with secret sharing in a way 
that will allow one to determine whether an eavesdrop- 
per has been active during the secret sharing protocol. 
The most obvious way of doing this is simply for Al- 
ice to use quantum cryptographic protocols to send each 
of the bit strings which result from the classical secret 
sharing procedure, and this method will work. It is, 
however, awkward. One first must establish mutual keys 
among different pairs of parties, in this case one for Alice 
and Bob, and another for Alice and Charlie, and then 
implement the classical procedure. The classical proce- 
dure, it should be pointed out, becomes more and more 
complicated the larger the number of pieces into which 
one wants to split the message. We would like to ex- 
plore an alternative which uses quantum mechanics to 
do both the information splitting and the eavesdropper 
protection simultaneously. By using multiparticle entan- 
glement, it eliminates the need to perform the classical 
secret-splitting procedure altogether. 

The method for splitting a message into two parts, 
which we present here uses maximally entangled three- 
particle states, or GHZ states, and it can be easily ex- 
tended in two different ways. First, it can be modified to 
allow Alice to send a string of qubits to Bob and Charlie 
in such a way that only by working together can they 
determine what the string is. In this case it is quantum 
information which has been split into two pieces, neither 
of which separately contains the original information, but 
whose combination does. Second, the procedure can also 
be generalized to more than three parties, and we show 
explicitly how it works with four. 
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GHZ states have already found a number of uses. They 
form the basis of a very stringent test of local realistic the- 
ories 1^ . Recently it was also proposed that they can used 
for cryptographic conferencing or for multiparticle gen- 
eralizations of superdense coding . In addition, related 
states can be used to reduce communication complexity 
1^. Quantum secret sharing represents yet another ap- 
plication. 



II. GHZ STATES AND SECRET SHARING 

Let us suppose that Alice, Bob, and Charlie each have 
one particle from a GHZ triplet which is in the state 
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They each choose at random whether to measure their 
particle in the x or y direction. They then announce 
publicly in which direction they have made a measure- 
ment, but not the results of their measurements. Half 
the time. Bob and Charlie, by combining the results of 
their measurements, can determine what the result of Al- 
ice's measurement was. This allows Alice to establish a 
joint key with Bob and Charlie, which she can then use 
to send her message. 

Let us see how this works in more detail. Define the x 
and y eigenstates 

|+x) = i=(|0) + |l)); |+y) = -L(|0)+*|l)); 

|-2;) = i=(|0)-|l)); |-j,) = -L(|0)-*|l)). (2) 

We can see the effects of measurements by Alice and Bob 
on the state of Charlie's particle, if we express the GHZ 
state in different ways. Noting that 

|0) = ^(|+x) + |-x)); \l) = ±i\+a:)-\-x)) (3) 

we can write 
1 
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+ x)a\+x)b + \- X)a\ - x)b){\Q)c + |l)c) 



+ (I + X)a\ -x)b + \- X),\ + X)b)(|0), - |1),)] . (4) 

This decomposition of \tp) tells us what happens if both 
Alice and Bob make measurements in the x direction. If 
they both get the same result, then Charlie will have the 
state (|0)c + |l)c)/\/2, and if they get different results he 
will have the state (|0)c - \l)c)/V2. He can determine 
which of these states he has by performing a measure- 
ment along the x direction. The following table summa- 
rizes the effects of Alice's and Bob's measurements on 
Charlie's state: 
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Alice's measurements are given in the columns and Bob's 
are given in the rows. Charlie's state, up to normaliza- 
tion, appears in the boxes. From the table it is clear that 
if Charlie knows what measurements Alice and Bob made 
(that is, X OT y), he can determine whether their results 
are the same or opposite, and also that he will gain no 
knowledge of what their results actually are. Similarly, 
Bob will not be able to determine what Alices's result is 
without Charlie's assistance, because he does not know if 
his result is the same as Alice's, or the opposite of hers. 

With each party choosing to make x or y measurements 
at random, only half of the GHZ triplets will give use- 
ful results. For example, if Alice and Bob both measure 
their particles in the x direction, Charlie must also mea- 
sure his in the x direction in order to determine whether 
the results of Alice's and Bob's measurements are corre- 
lated or ant icor related; if he measures in the y direction 
he gains no information. Because Charlie is choosing his 
measurement direction at random, he will only choose 
correctly half the time. This is why all three parties must 
announce the directions of their measurements, so that 
they can decide whether to keep or to discard the results 
from a given triplet. This announcement should be done 
in the following way: Bob and Charlie both send to Alice 
the direction of their measurements who then sends all 
three measurement directions to Bob and Charlie. 

Before presenting a more general discussion of eaves- 
dropping, we shall consider a specific situation in order 
to show that it can be detected. Suppose that Bob is dis- 
honest and that he has managed to get a hold of Charlie's 
particle as well as his own. He then measures the two par- 
ticles and sends one of them on to Charlie. His object 
is to discover what Alice's bit is, without any assistance 
from Charlie, and to do so in a way that cannot be de- 
tected. Alice has measured her particle in either the x 
or y direction, but Bob does not know which. He would 
like to measure the quantum state of his two-particle sys- 
tem, but because he does not know what measurement 
Alice made, he does not know whether to make his in the 
(|00) ± |11))/V2 basis or in the |00) ± i\n))/V2 basis. 
Choosing at random he has a probability of 1/2 of mak- 
ing a mistake. If he chooses correctly, he will know, for 
valid combinations of measurement axes, what the result 
of Charlie's measurement is from the result of his own, 
and this means he will then know what Alice's bit is. For 
example, if Alice measured in the x direction and found 
I +x), then the state Bob receives is |00) -I- \11))/V2. If 
Bob now measures in the |00)±|11))/V2 basis, he knows 
what the two- particle state is, and because 

-i=(|00) + 111)) = -L(| + :,) I + :,) + I _ ^)| _ ^)), (5) 
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Bob knows that Charlie's measurement will produce a 
result identical to his. 

What happens if he is wrong? Suppose that Alice has 
measured her particle in the y direction and that Bob 
measures his particles in the (joO) ± |ll))/%/2 basis. He 
has a probability of 1/2 of getting either basis vector. 
He now sends one of his particles to Charlie, and both 
Bob and Charlie measure their particles. Because Alice 
measured y, in order for this round of measurements to 
produce a valid key bit, Bob and Charlie must make dif- 
ferent measurements, i. e. one must measure x and the 
other y. We note that in the (|00) ± |ll))/\/2 basis there 
is no correlation between x and y measurements, for ex- 
ample 
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Therefore, in half the situations the results of the mea- 
surements will be wrong. If, for example, Alice found 
I -h y) and Bob found | -I- a;) , then Charlie should mea- 
sure I — y) if he measures his particle in the y direction, 
but because of Bob's measurement, he has a probability 
of 1/2 of finding | -f y). The overall probability of an 
error in this cheating scheme is 1/4, one half of picking 
the wrong basis and then one half of getting the wrong 
result. 

There are two additional points to notice here. First, 
if Bob were able to learn the direction of Alice's and 
Charlie's measurements before having to reveal his, he 
could cheat more successfully. In the cases in which he 
made the wrong measurement. Bob could simply tell Al- 
ice a measurement direction which would cause the re- 
sults from that triplet to be thrown out. Alice and Char- 
lie would, however, notice a higher than usual failure rate, 
75 % as opposed to 50 %, which would tell them that 
something unusual was happening. Insisting that Bob 
send a measurement direction to Alice before learning 
what kind of measurement Alice and Charlie makes this 
kind of cheating more difficult. Second, there is also the 
possibility that Bob could lie at certain points in the pro- 
cedure; he could lie about his measurement direction or 
about the result of his measurement. In the cheating 
scheme considered above he gains, however, nothing by 
doing so. 

Now let us look at a more general situation. We as- 
sume that there is an eavesdropper. Eve (who could also 
be either Bob or Charlie). Her problem, as in the exam- 
ple which we just discussed, is that she does not know 
what bases have been or will be used to measure the 
particles. If she measures them herself, and chooses the 
wrong bases, she will introduce errors which Alice, Bob 
and Charlie will be able to detect by publicly comparing 
a subset of their measurements. 

In order to show this for a large class of measurements, 
let us assume that Eve has been able to entangle an an- 
cilla with the three particle state which Alice, Bob, and 



Charlie are using. At some later time she can measure 
the ancilla to gain information about the measurement 
results of Alice, Bob and Charlie. The state describing 
the state of the three particles and the ancilla is 
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where Ijkn)^ is a state of the three particles, and \Rjkn)(, 
is an unnormalized ancilla state. What we wish to show 
is that if this entanglement introduces no errors into the 
secret sharing procedure, then j^*) must be a product of 
a GHZ triplet and the ancilla. This implies that Eve will 
gain no information about measurements on the triplet 
from observing the ancilla, or, conversely, if Eve is to 
gain information about Alice's bit, she must invariably 
introduce errors. 

First, suppose that Ahce, Bob, and Charlie all measure 
their particles in the x basis. If no errors are to occur we 
must have that 
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where p{C = +x\A — +x,B — +x) is the probability 
that Charlie measures +x given that both Alice and Bob 
measure +x, and the other quantities are similarly de- 
fined. These equations imply that 
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where P(+x, +x, —x) is the projection onto the subspace 
of the three particle-ancilla Hilbert space in which Al- 
ice's particle is in the -l-a:; direction, Bob's is in the +x 
direction, and Charlie's is in the —x direction. The other 
projection operators are defined in a similar manner. Ex- 
pressing the conditions in Eq. (^) in the z basis (the 
|0), |1) basis), we find that if projection operators corre- 
sponding to any of the vectors 
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(1100)3-1011)3); 

(1110)3-1001)3), (10) 



act on I'if), the result is zero. 

Now suppose that Alice measures her particle in the x 
basis, and Bob and Charlie measure theirs in the y basis. 
In order for their to be no errors we must have that 



p{C^-y\A 
p{C = +y\A 

which imply that 
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P(+a;,+y,+y)|*) = 0; 
P(+a;,-y,-y)|*) = 0, 



P{-x,-y,+y)\^)={)- 
P(-x,+y,-y)\^>)=0. (12) 
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Again expressing these conditions in the z basis we find 
that projection operators corresponding to the vectors 

i=(|ooo)3- 1111)3); -^(1100)3-1011)3); 

-^(1010)3 + 1101)3); -i=(|110)3 + 1001)3), (13) 

annihilate \^). 

So far we have six vectors to which the three-particle 
part of 1^*) must be orthogonal. A seventh, (|100)3 + 
|011)3)/-\/2, emerges when we demand that no errors oc- 
cur when Alice measures her particle in the y direction, 
Bob measures his in the x direction, and Charlie mea- 
sures his in the y direction. These conditions imply that 
must be of the form 
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i. e. a product of the GHZ state and an ancilla state, 
which is what we wished to show. 

Finally, let us conclude this section with a discussion 
of the resources necessary to implement quantum secret 
sharing protocols. In order to send a shared key contain- 
ing N bits it is necessary to use, on average 2iV GHZ 
triplets. If we instead use standard quantum cryptogra- 
phy and the classical secret sharing protocol, then either 
4iV entangled pairs, using the Ekert procedure [ |^], or 
4A'' particles, using the BB84 procedure [ |^], are re- 
quired. In all cases, the number of particles sent from 
Alice to Bob and Gharlie is 4A^. In the GHZ scheme, 
once the key has been established, Alice needs to send N 
classical bits in order to transmit the message. These bits 
can be sent to either Bob or Charlie using a public chan- 
nel. In the hybrid quantum-classical scheme Alice must 
send IN classical bits once keys with Bob and Charlie 
have been established - N bits to send the random string 
to Charlie and another N bits to send to Bob the string 
resulting from the bitwise XOR of the message and the 



random string. In general, the more parts into which 
the secret is split, the greater the difference between the 
number of classical bits which must be sent in the hybrid 
scheme and in the entangled-state scheme (MiV versus 
N for a secret split into M parts). We see that entangle- 
ment is able to act as a substitute for transmitted random 
bits. 



III. SPLITTING OF QUANTUM INFORMATION 

Now suppose that Alice has a string of qubits she would 
like to send to Bob and Charlie in such a way that they 
must cooperate in order to extract the quantum informa- 
tion. She can use shared GHZ triplets, |000)abc+|lll)a6c, 
and a procedure very similar to quantum teleportation 
to do this H] . The no-cloning theorem implies that only 
one copy of Alice's qubit can be received, so that either 
Bob or Charlie, but not both, will posses the final qubit 
Q . The procedure we shall present is symmetric in that 
either party can end up with the final qubit, but infor- 
mation from the other party is required before this can 
happen. Security could be enforced by requiring that 
Bob and Charlie meet in person to exchange the final in- 
formation and put the qubit to its final use. Let us now 
look in detail at the procedure for sending one qubit. 
We shall first describe the protocol, and then discuss the 
reasons for some of the steps. 

Alice begins by taking her qubit, which is in the state 
ck|0)yi -l- /?|1)a, combining it with her GHZ particle, and 
measuring the pair in the Bell basis 
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(15) 



We can determine the effect of this measurement on the 
particles which Bob and Charlie possess by expressing 
the entire four-particle state as 



l*)4= 2[l'J' + )Aa(a|0G)fcc+/3|ll)6c) 



*_)Aa(a|00)6c-/?|ll)fcc) 

$+)Aa(/?|00),„ + a|ll)fc,) + |$-)Aa(-/3|00)b, + a|ll)b,)]. 
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At this point Alice does not tell either Bob or Char- 
lie what the result of her measurement is. This implies 
that the single-particle density matrixes of both Bob's 
and Charlie's particles are (1/2)/, where / is the 2x2 
identity matrix, so that at this stage of the procedure nei- 
ther Bob nor Gharlie has any information about Alice's 
qubit. Alice now tells either Bob or Gharlie (she makes 
the choice at random) to measure his particle. It is the 
person who has not been chosen whose particle will con- 
tain the final qubit. The party which has been chosen to 
make the measurement, whom we shall assume to be Bob 



for this particular qubit, now measures his particle in the 
X direction, obtaining cither | -I- a:)ti or | — x)h- This still 
leaves Charlie's single-particle density matrix as (1/2)/, 
i. e. he still has no information about Alice's qubit. 

In order to reconstruct Alice's qubit Charlie needs two 
bits of classical information from Alice (which of the four 
Bell states she found) and one from Bob. Alice first 
verifies that both parties have received a particle, which 
we assume can be done over a public channel, and then 
sends Charlie the result of her measurement. If Alice's 
result was either |5'+)^a or |^'_)Aa, then Charhe's single- 
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particle density matrix is 

Pc = i«no)ec(oi + i/3ni),,(i|, 



(17) 



and if the result was either |$+)^a or then it is 

Pe= |/3n0),e(0| + |a|2|l),,(l|. (18) 

Charlie now has amplitude information about Alice's 
qubit, but knows nothing about its phase. Bob's one bit 
of classical information, in conjunction with the quan- 
tum information he now has, will give him the phase 
information and allow him to reconstruct Alice's qubit. 
In particular, the transformation which Charlie should 
perform in order to obtain Alice's qubit, up to an overall 
sign, are 
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\^ + )Aa\ + X)b (Tx] 
\^ + )Aa\ - X)b <Jx<Jz] 
\^-)Aa\ + x)b CTxO-z; 
\^-)Aa\-x)b^ax. (19) 



We see, then, that Charlie can reconstruct Alice's state 
but only with the assistance of Bob. Bob must both mea- 
sure his particle and send the result to Charlie. Without 
Bob's information, Charlie has no information about the 
phase of Alice's state. 

Let us now discuss this procedure. We are making 
the assumption that any communication over a classical 
channel is insecure. This means we cannot consider the 
simplest method of splitting the quantum information in 
Alice's qubit, which is just to use standard teleportation 
with an EPR pair and send the classical information to 
Bob and the second particle in the EPR pair to Charlie 
pOf . That is why the procedure we have outlined above 
is somewhat more complicated. Note that we could se- 
curely implement this protocol if Alice sent her two bits 
using standard quantum cryptography. She would on 
average, however, need 4 particles to do so, and an en- 
tangled pair to implement the teleportation procedure. 
In addition this procedure will require that five measure- 
ments be made, on average. The scheme we have pre- 
sented requires a single GHZ triplet, and two measure- 
ments. In effect, it substitutes entanglement for quantum 
mechanically implemented classical communication. 

Our next task is to see how it protects against cheating 
and eavesdropping. Let us first note that is Alice's ability 
to choose which particle, Bob's or Charlie's, is to receive 
the final qubit prevents cheating by one of the parties if 
they manage to get a hold of both of the particles which 
Alice sends. Suppose, for example, that Charlie is dis- 
honest, that he has managed to obtain both particles, 
and that he has sent a particle which he has prepared 
to Bob. If Alice chooses Charlie to receive the qubit, his 
cheating will go undetected; one Charlie has the result 
of Alice's measurement he has her qubit, and the result 
of Bob's measurement is irrelevant. On the other hand, 
if she chooses Bob, then Charlie has a problem. At the 



time he sent the particle to Bob, Charlie did not know the 
result of Alice's measurement, and therefore the particle 
he sent to Bob is not in the proper quantum state. Alice 
and Bob can detect this by comparing a subset of the 
states Bob received to the ones Alice sent, which would 
reveal Charlie's cheating. 

This procedure also guarantees that if an eavesdrop- 
per or a cheater has entangled an ancilla with the three- 
particle state, then errors will be introduced. If the GHZ 
state in the above protocol is replaced by the state in Eq. 
(0) , then one can show, using an argument similar to the 
one in the previous section, that if no errors are intro- 
duced by the addition of the ancilla, then the state | ^I*) 
is just a product of the GHZ state and an ancilla state. 
This again implies that measurements on the ancilla will 
tell an eavesdropper nothing about the state of the three 
particles held by Alice, Bob, and Charlie. 



IV. FOUR-PARTICLE GHZ STATE 

It is possible to generalize this procedure to split infor- 
mation among more than two people. Let us look specifi- 
cally at the case of three. Alice starts with a four-particle 
GHZ state. 
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keeps one particle for herself and gives one particle each 
to Bob, Charlie, and Diana. Her object is to generate 
a shared key bit which can only be figured out by Bob, 
Charlie, and Diana if they cooperate. 

A method of accomplishing this can be found by ex- 
pressing the state I?/;) 4 in different combinations of x and 
y bases. If the state is expressed completely in the x 
basis, 



4\/2 
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where j runs over the set {Alice, Bob, Charlie, Diana}, 
we see that the right-hand side is an an equal superpo- 
sition of all four-particle basis states, where each single 
particle state is in the x basis, with an even number of 
—X states. This means that if all four people have each 
measured their particles in the x direction, then Bob, 
Charlie and Diana can, by combining their results, deter- 
mine what the result of Alice's measurement was. They 
simply count the number of —x measurements, and if it 
is even, then Alice must have found +x, and if it is odd, 
then Alice must have measured —x. It is necessary for 
all three of them to combine their information in order 
to determine Alice's result, no subset will do. Therefore, 
Alice has succeeded in splitting her message into three 
parts. 
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In order to foil eavesdroppers and cheaters, the four 
parties do not want to use only a single basis, so we must 
examine what happens if different combinations of x and 
y bases are used. Expressing \ip)i in the y basis we find 
that it is an equal superposition of all four-particle basis 
states, where each single particle state is in the y basis, 
with an even number of \ — y) states. This allows Bob, 
Charlie and Diana to determine Alice's state in the same 
way as in the x basis case. If two of the particles are ex- 
pressed in the x basis and two in the y basis, then we see 
that 1-0)4 is an equal superposition of the 16 basis vectors 
with two particles in the x basis and two in the y basis 
(with the same two in the x basis and the same two in the 
y basis in each of the four-particle basis vectors) which 
have an odd number of minus states. For example, if the 
first two particles are expressed in the x basis and the 
second two in the y basis, the states \ — x)\+ x)\ + y)\+y) 
and \ — x)\+x)\^y)\ — y) would appear in the expansion of 
1-0)4. Again, Bob, Charlie, and Diana can determine Al- 
ice's state by counting the number of minus states which 
appeared as results of their measurements. 

If three particles are expressed in one basis and the 
remaining one in the other, then |'0)4 is a superposition 
of all 16 basis vectors. This means that there are no cor- 
relations among the measurements which will allow Bob, 
Charlie, and Diana to infer the result of Alice's mea- 
surement. If all four parties are choosing their bases at 
random, this means that in half the cases, they will not 
be able to use the results. 

Summarizing, each of the four parties performs a mea- 
surement on their particle in either the x or y basis. They 
then communicate their choice of basis to Alice (classi- 
cally) who decides if the overall basis choice is a usable 
one, and she then communicates all four basis choices to 
each of the other three parties. Using this information 
and the results of their measurements, they can, if they 
act in concert, determine the result of Alice's measure- 
ment. This means that Alice, on the one hand, and Bob, 
Charlie, and Diana on the other, will have, on repeating 
this process, a shared key. A calculation similar to the 
one presented in Section 2 shows that if an eavesdropper 
tries to entangle an ancilla with the four-particle GHZ 
state, then she will invariably introduce errors, and her 
presence can be detected. 



V. CONCLUSION 

We have shown that GHZ states can be used to split 
information in such a way that if one is in possession of 
all of the parts, the information can be recovered, but if 
one has only some of the parts, it cannot. This applies 
to both classical and quantum information. In the case 
of classical information a shared key can be established 
between one party and several others all of whom must 
work in concert. An eavesdropper or a cheater will intro- 



duce errors and can thereby be detected. In the case of 
quantum information the information in a qubit is split 
into two parts so that if the parts are recombined, the 
qubit can be recovered. 

This represents a different kind of information splitting 
than occurs in quantum copiers |]ll[| . There the object is 
to split the information in one qubit into two parts so 
that each part contains as much information about the 
original qubit as possible. However, in that case one can- 
not reconstruct the original qubit by combining the two 
copies. 

The key point in all of this is that multiparticle entan- 
gled states can be used to split information into parts. 
This can be useful in maintaining security, as has been 
shown here, but there may be applications in the pro- 
cessing of quantum information as well. 
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